Vulnerability CVE-2018-10850


Published: 2018-06-13

Description:
389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.

Type:

CWE-362

Vendor: Debian
Product: Debian linux 
Version: 8.0;
Vendor: Redhat
Product: Enterprise linux 
Version: 7.0;
Vendor: Fedoraproject
Product: 389 directory server 
Version:
1.4.0.9
1.4.0.8
1.4.0.7
1.4.0.6
1.4.0.5
1.4.0.4
1.4.0.3
1.4.0.2
1.4.0.1
1.4.0.0
1.3.8.2
1.3.8.1
1.3.7.9
1.3.7.8
1.3.7.7
1.3.7.6
1.3.7.5
1.3.7.4
1.3.7.3
1.3.7.2
1.3.7.10
1.3.7.1
1.3.6.9
1.3.6.8
1.3.6.7
1.3.6.6
1.3.6.5
1.3.6.4
1.3.6.3
1.3.6.2
1.3.6.15
1.3.6.14
1.3.6.13
1.3.6.12
1.3.6.11
1.3.6.10
1.3.6.1
1.3.6.0
1.3.5.4
1.3.5.3
1.3.5.2
1.3.5.19
1.3.5.18
1.3.5.17
1.3.5.16
1.3.5.15
1.3.5.14
1.3.5.13
1.3.4.9
1.3.4.8
1.3.4.5
1.3.4.4
1.3.4.14
1.3.4.1
1.3.4.0
1.3.3.9
1.3.3.8
1.3.3.5
1.3.3.3
1.3.3.2
1.3.3.14
1.3.3.13
1.3.3.12
1.3.3.11
1.3.3.10
1.3.3.0
1.3.2.9
1.3.2.8
1.3.2.7
1.3.2.6
1.3.2.5
1.3.2.4
1.3.2.3
1.3.2.27
1.3.2.26
1.3.2.24
1.3.2.23
1.3.2.22
1.3.2.2
1.3.2.19
1.3.2.16
1.3.2.13
1.3.2.11
1.3.2.10
1.3.1.9
1.3.1.8
1.3.1.7
1.3.1.6
1.3.1.5
1.3.1.4
1.3.1.3
1.3.1.22
1.3.1.2
1.3.1.19
1.3.1.18
1.3.1.17
1.3.1.16
1.3.1.15
See more versions on NVD

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:N/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.1/10
6.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Complete

 References:
https://access.redhat.com/errata/RHSA-2018:2757
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10850
https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html
https://pagure.io/389-ds-base/c/8f04487f99a
https://pagure.io/389-ds-base/issue/49768

Related CVE
CVE-2018-16883
sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to l...
CVE-2018-19591
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.
CVE-2018-14648
A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the do_search() function. An unauthenticated attacker could use this flaw to provoke a denial of service.
CVE-2018-14638
A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.
CVE-2018-14624
A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modific...
CVE-2018-14348
libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information.
CVE-2017-12173
It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a gi...
CVE-2018-10871
389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective ...

Copyright 2019, cxsecurity.com

 

Back to Top